{
  "id": 19707604,
  "title": "CVE-2026-119618: Critical Apache mod_http2 Flaw Allows Unauthenticated Remote Code Execution",
  "url": "https://urgent.news/2026/11/12/cve-2026-119618-critical-apache-mod-http2-flaw-allows-unauthenticated",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-12T21:05:11.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/etairos/cve-2026-119618-critical-apache-modhttp2-flaw-allows-unauthenticated-remote-code-execution-36ic"
  },
  "original_language": "en",
  "account": "CVE-2026-119618 is a critical code execution flaw found in Apache HTTP Server's mod_http2 module. This vulnerability affects versions 2.4.55 through 2.4.70 and standalone mod_h2 from 2.0.8 through 2.0.42. An unauthenticated attacker with access to an HTTP/2-enabled server can exploit this flaw to take full control of the server process. Apache HTTP Server developers have released version 2.4.71 to address the issue, but many downstream packages remain unfixed as of November 12. Debian stable, Amazon Linux, and Red Hat JBoss Core Services are among the affected distributions. To mitigate the vulnerability, Red Hat advises disabling HTTP/2 on servers that cannot be updated promptly. The upstream patch is now available, but many organizations are still vulnerable until they apply the fix or disable HTTP/2.",
  "summary": "TL;DR what: CVE-2026-119618 is a code execution flaw in Apache HTTP Server's mod_http2 module that affects versions 2.4.55 through 2.4.70 and standalone mod_h2 2.0.8 through 2.0.42. impact: An unauthenticated attacker who can reach a server with HTTP/2 enabled can take full control of the server process, according to Red Hat. fix: Apache HTTP Server 2.4.71 fixes the flaw, Red Hat has shipped…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Hacker News",
        "title": "Critical Zoom Workplace Flaw Could Allow Unauthenticated Remote Privilege Escalation",
        "url": "https://urgent.news/2026/11/11/critical-zoom-workplace-flaw-could-allow-unauthenticated-remote",
        "published": "2026-11-11T16:12:46.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}